MIGAN: GAN for facilitating malware image synthesis with improved malware classification on novel dataset

Malware visualization is a technique wherein malware binaries are represented as grayscale or color images in order to identify and extract discriminating features for classification. This technique is effectively better than classic machine learning based malware recognition techniques that require significant domain expertise or time-consuming behavioral analysis to identify discriminating features. In this manuscript, a Generative Adversarial Network (GAN) architecture is introduced for facilitating malware image synthesis called ‘MIGAN’, that can quickly produce high-quality synthetic malware images and then classify malware samples into families. The proposed framework consists of a generator and discriminator network paired with a classification module. The novelty exists in the GAN network structure, hybrid loss function, new dataset and classification network structure. The MIGAN generated images manage to achieve better Inception Score than original malware images (2.81 vs 1.90, respectively) along with better Fréchet Inception Distance score and Kernel Inception Distance score. The synthetic malware images primarily serve two purposes: firstly, it solves the class imbalance problem in custom built and public ‘Malimg’ datasets. Secondly, since these images resemble existing malware images, it is assessed to be fairly similar to upcoming ‘zero-day’ or ‘previously unseen’ malware that can be eventually discovered in the future. The two classification networks (custom classification network with traditional learning approach and pretrained Resnet50v2 network with transfer learning approach) were supplemented and trained with nearly 50,000 synthetic malware images. The proposed framework achieved promising scores of 99.2% Area Under the Curve (AUC), 99.3% F1-score and 99.5% Accuracy. The comprehensive evaluation and excellent results demonstrate the effectiveness of the proposed framework. This framework can also be applied to image synthesis with several other types of images.